diff --git a/site-cookbooks/kosmos-bitcoin/recipes/aws-client.rb b/site-cookbooks/kosmos-bitcoin/recipes/aws-client.rb
index 04e6d84..8debd9b 100644
--- a/site-cookbooks/kosmos-bitcoin/recipes/aws-client.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/aws-client.rb
@@ -11,6 +11,7 @@ credentials = Chef::EncryptedDataBagItem.load('credentials', 'backup')
 
 file "/root/.aws/config" do
   mode "600"
+  sensitive true
   content lazy { <<-EOF
 [default]
 region = #{credentials["s3_region"]}